Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A 100k Botnet Turns Home Routers to Email Spammers

blog.netlab.360.com

Post reply on HN
Print view View original

61–70 of 122 posts

Re: A 100k Botnet Turns Home Routers to Email Spammers

#61

Post by eikenberry »

walrus01 wrote: post #45
9712263 wrote: post #38

So, what is the most secured option for the moment? Buy a x86 box and turn it into a router? But it consumes more power than a low-power router, and buying more network adapter is not that cheap. I am currently using the open source tomato firmware. However, since there is a bug/feature in the router so that I cannot flash an image too large, or otherwise it would not work. Also, the configuration is limited to 32 KB…

For something really small the ubiquiti edgerouter devices which run their EdgeOS are a good choice. If there's a serious security vulnerability on the WAN-facing interface it will be patched. They run a fork of Vyatta. Ubiquiti employs most of the old Vyatta development team, who did not go to Brocade when Vyatta was acquired. Or build a really small low power x86 system with a few Intel gigabit NICs in it and run o…

So the ERLite-3?

https://www.ubnt.com/edgemax/edgerouter-lite/

Re: A 100k Botnet Turns Home Routers to Email Spammers

#62

Post by albertgoeswoof »

Scoundreller wrote: post #60

I’ve said it before: it shouldn’t be that hard for someone handy with a soldering iron to “harden” their router: Look up the Pinout for the flash chip, find the write-enable line, and put it on a switch to lock firmware updates. This won’t protect you against non-persistent malware, but it will prevent malicious updates. One could attach a bit of logic and an LED to this line to switch on when a flash is attempted. T…

What about non malicious security updates?

Re: A 100k Botnet Turns Home Routers to Email Spammers

#63

Post by Scoundreller »

albertgoeswoof wrote: post #62
Scoundreller wrote: post #60

I’ve said it before: it shouldn’t be that hard for someone handy with a soldering iron to “harden” their router: Look up the Pinout for the flash chip, find the write-enable line, and put it on a switch to lock firmware updates. This won’t protect you against non-persistent malware, but it will prevent malicious updates. One could attach a bit of logic and an LED to this line to switch on when a flash is attempted. T…

What about non malicious security updates?

Flip the switch when you want to allow them (but why accept random OTA updates?).

The LED logic should signal you when there's an update coming in OTA, and you can verify for yourself if there's a legitimate update (and possibly load it yourself).

Re: A 100k Botnet Turns Home Routers to Email Spammers

#64

Post by dcbadacd »

rubatuga wrote: post #35
OJFord wrote: post #28

Earlier quoted context omitted.

I keep looking into it and keep stopping at 'what should I buy'. I'm willing to / assume I need to buy new hardware. What do I buy that will run it well, and continue to?

Buy the Archer C7 version 2, and install the optimized version of openwrt: https://github.com/infinitnet/lede-ar71xx-optimized-archer-c... This build gets ~750 mbps NAT speed as opposed to vanilla openwrt, which is around ~300 mbps.

How can you make sure you're getting the v2?

Re: A 100k Botnet Turns Home Routers to Email Spammers

#66

Post by mark-r »

eikenberry wrote: post #54
mark-r wrote: post #48

Earlier quoted context omitted.

I think you just killed the site. I get a 504 error.

https://web.archive.org/web/20181112153533/https://blog.netl...

Thanks for that! The usual Google cache wasn't working for me in this case.

Re: A 100k Botnet Turns Home Routers to Email Spammers

#67

Post by DanBlake »

9712263 wrote: post #38

So, what is the most secured option for the moment? Buy a x86 box and turn it into a router? But it consumes more power than a low-power router, and buying more network adapter is not that cheap. I am currently using the open source tomato firmware. However, since there is a bug/feature in the router so that I cannot flash an image too large, or otherwise it would not work. Also, the configuration is limited to 32 KB…

I think its been around 7 years since a public exploit has been dropped for the apple airport extreme. YMMV though, as Apple has stopped selling them which means support is likely going to be minimal in the future if something does pop up. Alot of it is likely security through obscurity though as obviously the code is closed source and it uses a custom management interface vs web-access.

If you want to go the modern (better) route, enterprise equipment such as ubiquity or cisco with strict rules are likely your best bet. The budget option being a openwrt install with one of their recommended routers

Re: A 100k Botnet Turns Home Routers to Email Spammers

#68

Post by walrus01 »

eikenberry wrote: post #61
walrus01 wrote: post #45

Earlier quoted context omitted.

For something really small the ubiquiti edgerouter devices which run their EdgeOS are a good choice. If there's a serious security vulnerability on the WAN-facing interface it will be patched. They run a fork of Vyatta. Ubiquiti employs most of the old Vyatta development team, who did not go to Brocade when Vyatta was acquired. Or build a really small low power x86 system with a few Intel gigabit NICs in it and run o…

So the ERLite-3? https://www.ubnt.com/edgemax/edgerouter-lite/

the $48 ER-X is much faster than 99% of peoples' residential last mile broadband connections, it's good for up to about 750 Mbps of NAT and default route outbound to a gateway.

Re: A 100k Botnet Turns Home Routers to Email Spammers

#69

Post by WorldMaker »

OJFord wrote: post #27
commandlinefan wrote: post #8

> Universal Plug-n-Play And, like so many other attempts to "simplify" supposedly complex configuration, in addition to being a massive security hole to attackers, it's almost useless to the home users for whom it was meant because it only works under a very narrow, mostly undocumented set of assumptions and if any of those assumptions are invalid, it fails silently.

I disabled it after this post, but it appears Plex switches to 'indirect' mode (it goes out to the Internet and back in) without it; i.e. I am using UPnP. It's not clear what the solution is - update firmware? I am on the latest. Use OpenWRT (or whatever it's called these days)? Every time I look into it (I really want to!) I stop at the simple 'I want to do this, I will happily buy a new router, which one do I buy a…

Plex has had a major forum breach for basic user data including IP addresses [1], around the time of the botnet's first discovery in 2017, which has me greatly wondering if Plex may have been an inadvertent bootstrap vector for this attack?

Worrying, if that's the case.

[1] https://haveibeenpwned.com/PwnedWebsites#Plex

Post reply on HN